Stand-alone, dedicated device for safely selecting host interface ports to control a long-term storage device

Abstract

There is a need for law enforcement officials to examine the contents of long-term storage devices, such as hard drives. This includes even hard drives that are part of video game systems, such as Microsoft's Xbox. The hard drive on an Xbox is password protected or “locked”, making examination time consuming, as the password has to be “cracked”. However, upon the Xbox being powered up, the Xbox unlocks its drive. The present invention makes use of this feature and teaches systems and methods of allowing the Xbox (and similar devices) to unlock their drives, and then switching control of the drive to a second host.

1 . A dedicated, stand-alone switching device comprising:
 an interface for connecting to a host (original); and   an interface for connecting to a second host (forensic); and   an interface for connecting to a storage device (storage); and   logic and circuitry coupled to the interfaces, the logic and circuitry determining when the storage device has been put into an unlocked state and then switching from the host (original) controlling the storage device to the second host (forensic) controlling the storage device, wherein the switching device is transparent to the normal operation of the original host's operating system and second host's operating systems.   
   
   
       2 . The dedicated, stand-alone switching device of  claim 1  wherein a mechanical switch is used to indicate to the switching device that a switch is desired. 
   
   
       3 . The dedicated, stand-alone switching device of  claim 1  further comprising a user interface (such as Light Emitting Diodes) to indicate to a user whether the original host or the forensic host is controlling the storage device. 
   
   
       4 . The dedicated, stand-alone switching device of  claim 1  wherein the logic and circuitry insure there are no pending commands issued from original host that would need to be cleared before switching to forensic host. 
   
   
       5 . The dedicated, stand-alone switching device of  claim 1  wherein the logic and circuitry monitor commands issued by the original host and when a disable password command is detected switches from the original host to the forensic host. 
   
   
       6 . The dedicated, stand-alone switching device of  claim 5  wherein the logic and circuitry insert a pre-determined delay after detecting a disable password command. 
   
   
       7 . The dedicated, stand-alone switching device of  claim 1  wherein the logic and circuitry monitor commands issued by the original host and when a “write to” command is detected switches from the original host to the forensic host. 
   
   
       8 . The dedicated, stand-alone switching device of  claim 7  wherein the logic and circuitry insert a pre-determined delay after detecting a “write-to” command. 
   
   
       9 . The dedicated, stand-alone switching device of  claim 7  wherein the logic and circuitry discard the “write-to” command and a “fake” command is substituted. 
   
   
       10 . The dedicated, stand-alone switching device of  claim 1  further comprising a physical switch to accept user input. 
   
   
       11 . The dedicated, stand-alone switching device of  claim 10  wherein the logic and circuitry switches between original host and forensic host depending on the physical switch setting. 
   
   
       12 . The dedicated, stand-alone switching device of  claim 10  further comprising “debouncing” circuitry to provide a clean signal from the physical switch to the logic and circuitry. 
   
   
       13 . The dedicated, stand-alone switching device of  claim 10  further comprising a user interface (such as light emitting diodes) to indicate the state of the switch.